>From 682aba0bc40f8a7ca68f5f5f878033d5e260de27 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Wed, 17 Apr 2013 11:33:41 +0200 Subject: [PATCH] Convert the simple access check to new error codes https://fedorahosted.org/sssd/ticket/453 It makes sense to keep using the boolean for access granted/denied, but when the user/group is not found, the request would now return ERR_ACCOUNT_UNKNOWN --- src/providers/simple/simple_access_check.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/src/providers/simple/simple_access_check.c b/src/providers/simple/simple_access_check.c index 663b7ceacf8e23a4505313be706f75d6a89f950e..62add67f643d22ca79b24eb9f1d4106118a26f5a 100644 --- a/src/providers/simple/simple_access_check.c +++ b/src/providers/simple/simple_access_check.c @@ -190,7 +190,8 @@ simple_resolve_group_send(TALLOC_CTX *mem_ctx, goto done; } else if (ret != EAGAIN) { DEBUG(SSSDBG_OP_FAILURE, - ("Cannot check if group was already updated\n")); + ("Cannot check if group was already updated [%d]: %s\n", + ret, strerror(ret))); goto done; } /* EAGAIN - still needs update */ @@ -252,7 +253,7 @@ simple_resolve_group_check(struct simple_resolve_group_state *state) state->name = ldb_msg_find_attr_as_string(group, SYSDB_NAME, NULL); if (!state->name) { DEBUG(SSSDBG_OP_FAILURE, ("No group name\n")); - return ENOENT; + return ERR_ACCOUNT_UNKNOWN; } if (is_posix(group) == false) { @@ -371,6 +372,7 @@ simple_check_get_groups_send(TALLOC_CTX *mem_ctx, username, attrs, &user); if (ret == ENOENT) { DEBUG(SSSDBG_MINOR_FAILURE, ("No such user %s\n", username)); + ret = ERR_ACCOUNT_UNKNOWN; goto done; } else if (ret != EOK) { DEBUG(SSSDBG_OP_FAILURE, @@ -629,11 +631,15 @@ struct tevent_req *simple_access_check_send(TALLOC_CTX *mem_ctx, DEBUG(SSSDBG_FUNC_DATA, ("Simple access check for %s\n", username)); ret = simple_check_users(ctx, username, &state->access_granted); - if (ret != EAGAIN) { - /* Both access denied and an error */ + if (ret != EOK && ret != EAGAIN) { + ret = ERR_INTERNAL; + goto immediate; + } else if (ret == EOK) { goto immediate; } + /* EAGAIN -- check groups */ + if (!ctx->allow_groups && !ctx->deny_groups) { /* There are no group restrictions, so just return * here with whatever we've decided. @@ -648,7 +654,7 @@ struct tevent_req *simple_access_check_send(TALLOC_CTX *mem_ctx, */ subreq = simple_check_get_groups_send(state, ev, ctx, username); if (!subreq) { - ret = EIO; + ret = ERR_INTERNAL; goto immediate; } tevent_req_set_callback(subreq, simple_access_check_done, req); @@ -692,7 +698,9 @@ static void simple_access_check_done(struct tevent_req *subreq) ret = simple_check_groups(state->ctx, state->group_names, &state->access_granted); if (ret != EOK) { - tevent_req_error(req, ret); + DEBUG(SSSDBG_OP_FAILURE, ("Could not check group access [%d]: %s\n", + ret, strerror(ret))); + tevent_req_error(req, ERR_INTERNAL); return; } -- 1.8.1.4